CVE-2017-9096

creationtimestamp| type| source ---|---|--- 2026-09-02 01:00:11+00:00| seen| Telegram/LQpXoSxiIMyLvjThS3pKr95lLo1oYU2fC4knuXd1KuqMh5Y 2026-09-02 01:00:12+00:00| seen| Telegram/XmAeLpCnDR7fQWWs5ZgvKZOpllMiY5ATwXxwRV07Zq46AA 2026-09-03 00:00:54+00:00| published-proof-of-concept|...

Security Bulletin: IBM Daeja ViewONE Virtual 5.0.14 iFix 5 addresses CVE-2017-9096

Summary IBM Daeja ViewONE Virtual 5.0.14 iFix 5 released on October 3, 2024 addresses the vulnerable library iText reported under CVE-2017-9096 by removing it. Vulnerability Details CVEID:CVE-2017-9096 DESCRIPTION: iText PDF Library could allow a remote authenticated attacker to obtain sensitive...

net.sf.datavision:datavision (1.1.0) potentially affected by CVE-2017-9096 via com.lowagie:itext (2.0.1)

com.lowagie:itext MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - net.sf.datavision:datavision 1.1.0 Source cves: CVE-2017-9096 Source advisory: OSV:GHSA-86P9-X5PW-94QX...

io.github.martinhickson:jboss-seam-pdf-jakarta (>=2.4.1-bravura-36, <=2.4.1-bravura-38), org.chtijbug.drools:drools-framework-rest-guvnor (>=drools-framework-parent-1.5.3, <=1.5.2) +17 more potentially affected by CVE-2017-9096 via com.lowagie:itext (2.1.2)

com.lowagie:itext MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - io.github.martinhickson:jboss-seam-pdf-jakarta =2.4.1-bravura-36, =drools-framework-parent-1.5.3,...

com.nerderg.ajaxanywhere:ajaxanywhere-testapp (>=2.0, <=2.1.1), displaytag:displaytag (>=1.1.1, <=1.2) +18 more potentially affected by CVE-2017-9096 via com.lowagie:itext (1.3)

com.lowagie:itext MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - com.nerderg.ajaxanywhere:ajaxanywhere-testapp =2.0, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =2.3.0, =2.1.0-m1, =2.1.0-m1, =2.1.0-m1,...

com.gitee.huanminabc:file-tool (>=1.0.0-release, <=1.0.3-release), com.gitee.huanminabc:utils-server (>=1.0.0-release, <=1.0.3-release) +99 more potentially affected by CVE-2017-9096 via com.lowagie:itext (2.0.8)

com.lowagie:itext MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - com.gitee.huanminabc:file-tool =1.0.0-release, =1.0.0-release, =1.0.0-release, =6.0, =2.5, =1.1.14, =1.1.14, =4.2.0, =1.1.14,...

ai.libs:jaicore-ea (>=0.1.0, <=0.2.7), com.d3xsystems:d3x-morpheus-viz (>=1.0.22, <=1.0.31) +406 more potentially affected by CVE-2017-9096 via com.lowagie:itext (2.1.5)

com.lowagie:itext MAVEN version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - ai.libs:jaicore-ea =0.1.0, =1.0.22, =1.0.2, =0.2.0, =adempiere-3.9.4-abp-1.0.3, =1.0.0, =1.0.0, =shw-1.0.0, =1.0.0, =1.0.0,...

com.github.nruzic.org.apache.maven.doxia:doxia-doc-renderer (>=1.8.1-interpolation-hotfix-rc4, <=1.8.1.1), com.github.spyhunter99:findbugs-report-plugin (>=1.0.0, <=1.0.2) +11 more potentially affected by CVE-2017-9096 via com.lowagie:itext (1.4)

com.lowagie:itext MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - com.github.nruzic.org.apache.maven.doxia:doxia-doc-renderer =1.8.1-interpolation-hotfix-rc4, =1.0.0, =1.0.2, =1.5.0.1,...

aero.m-click:mcpdf (>=0.2.0, <=0.2.4), at.iem:sysson_2.10 (1.12.0) +506 more potentially affected by CVE-2017-9096 via com.itextpdf:itextpdf (>=5.0.6, <=5.5.11)

com.itextpdf:itextpdf MAVEN version =5.0.6, =0.2.0, =1.10.2, =1.13.0, =1.1.8, =20.3.0, =24.2.0, =20.3.0, =2.23.5, =2.23.5, =23.1.0, =2.23.0, =2.23.5, =20.2.0 and more Source cves: CVE-2017-9096 Source advisory: OSV:GHSA-86P9-X5PW-94QX...

br.net.woodstock.rockframework:rockframework-core (>=1.2.1, <=1.2.2), es.klicap.sonar:pdf-report (1.1) +7 more potentially affected by CVE-2017-9096 via com.lowagie:itext (2.1.4)

com.lowagie:itext MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - br.net.woodstock.rockframework:rockframework-core =1.2.1, =0.1, =1.0.30.1.0, =1.2, =1.3.1, =0.1, =1.0-beta3, =1.0-beta4 Sourc...

it.micegroup.displaytag:displaytag (>=2.0, <=2.1), it.micegroup:displaytag (2.2) +29 more potentially affected by CVE-2017-9096 via com.lowagie:itext (1.4.8)

com.lowagie:itext MAVEN version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.lowagie:itext and may be impacted: - it.micegroup.displaytag:displaytag =2.0, =0.9.4, =0.9.4, =0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.2...

africa.absa:inception-reporting (>=1.0.0, <=1.2.0), africa.absa:inception-reporting-api (>=1.0.0, <=1.2.0) +284 more potentially affected by CVE-2017-9096 via com.lowagie:itext (>=4.2.0, <=4.2.2)

com.lowagie:itext MAVEN version =4.2.0, =1.0.0, =1.0.0, =2.0.7, =1.0.0, =1.0.7, =2.1.0, =2.1.0, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =v1.0.26, =1.0.58 and more Source cves: CVE-2017-9096 Source advisory: OSV:GHSA-86P9-X5PW-94QX...

aero.m-click:mcpdf (>=0.2.0, <=0.2.4), at.iem:sysson_2.10 (1.12.0) +506 more potentially affected by CVE-2017-9096 via com.itextpdf:itextpdf (>=5.0.6, <=5.5.11)

com.itextpdf:itextpdf MAVEN version =5.0.6, =0.2.0, =1.10.2, =1.13.0, =1.1.8, =20.3.0, =24.2.0, =20.3.0, =2.23.5, =2.23.5, =23.1.0, =2.23.0, =2.23.5, =20.2.0 and more Source cves: CVE-2017-9096 Source advisory: GHSA-86P9-X5PW-94QX...

Oracle Primavera Unifier (Oct 2020 CPU)

The 16.1-16.2, 17.7-17.12, 18.8, and 19.12 versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Platfor...

CVE-2017-9096

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity XXE attacks via a crafted PDF...

iText PDF Library 7.0.2 / 5.5.11 / 2.0.8 XXE Injection Vulnerability

Exploit for java platform in category remote exploits Product: iText PDF Library Vendor: iText Group CVE ID: CVE-2017-9096 Subject: XML External Entity Attack XXE Risk: Medium Effect: Remotely exploitable Author: Benjamin Bruppacher Date: 2017-11-06 Introduction: ------------- iText is a software...

CVE-2017-9096

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity XXE attacks via a crafted PDF...

aero.m-click:mcpdf (>=0.2.0, <=0.2.4), at.iem:sysson_2.10 (1.12.0) +506 more potentially affected by CVE-2017-9096 via com.itextpdf:itextpdf (>=5.0.6, <=5.5.11)

com.itextpdf:itextpdf MAVEN version =5.0.6, =0.2.0, =1.10.2, =1.13.0, =1.1.8, =20.3.0, =24.2.0, =20.3.0, =2.23.5, =2.23.5, =23.1.0, =2.23.0, =2.23.5, =20.2.0 and more Source cves: CVE-2017-9096 Source advisory: MEND:CVE-2017-9096...

CVE-2017-9096

The CVE-2017-9096 issue concerns the iText PDF library where XML parsers do not disable external entities, enabling XXE via crafted PDFs. Public docs identify the root cause as improper XML External Entity handling in iText before 5.5.12 and before 7.0.3, with IBM Bulletins noting fixes in IBM Da...